ID. Date of interview 
date 42/92/20 


ID. Time interview started 
Start 08:38:25 


ID.end Completion date of interview 
Date 42/02/20 


ID.end Time interview ended 
09:21:34 


ID. Duration of interview 
time 43.15 


new Case 


ICO consultation on the draft right of access 
guidance 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don’t know, what other issues would you like to be covered in it? 


Q2 


Does the draft guidance contain the right level of detail? 
O) Yes 
No 
©) Unsure / don't know 


If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


P17 — where do we stand with a complex request that’s been extended and then e.g. 6 weeks in, they put 
in another SAR/change the scope of the request. Is that a new request, can we start the clock again on 
the whole SAR starting that date? P23 - Request timescale doesn’t stop when clarification is being 
sought — what happens if the individual doesn’t provide clarification promptly (or at all)? Undertaking a full 
disclosure of any possible records across an organisation with a wide variety of services is 
disproportionate if the individual is not willing to provide clarification to assist in identifying relevant 
records. P31 — Commonly used format - what would be considered "commonly used" when releasing 
audio files? P50 — Functions designed to protect the public — needs to be absolutely clear which 
controllers can rely on the first four functions, as it’s not clear. P51 — Expand on the legislation to make it 
clearer which organisations might be affected and what processes these are. P59 - Unstructured files — 
does this include general notebooks belonging to staff that are used for rough notes but do not form part 
of a formal record? Can this include emails that aren't associated with a particular case? 


Q3 


Does the draft guidance contain enough examples? 


Yes 


© No 
©) Unsure / don't know 

If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 

P50 - Functions designed to protect the public - Examples of these points would be helpful. 


Q4 


We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 


unfounded or excessive’ subject access requests. We would like to include a wide 
range of examples 

from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 

requests below (if applicable). 


o Member of staff example - request from an employee or ex-employee requesting 
all records relating to them from the time they started working at the organisation, 
including all emails that reference their name, initials or job title. The member of 
staff used email everyday in their role and many of the emails do not relate to them, 
but to work they were completing for the organisation. o Customer example - 
request for “all information you hold on me” that does not identify a particular 
service and the customer has asked for everything from their date of birth to 
present. The organisation has a large range of services across multiple systems. 


Q5 Ona scale of 1-5 how useful is the draft guidance? 


3- 
1-Notatall 2-Slightly Moderately 4-—Very 5-Extremely 
useful useful useful useful 


useful 
| ) t 


O O © O 
t a aa 


Q6 Why have you given this score? 

The examples given are very good, and the clarification on validating identities is 
helpful. However, some of the changes will negatively impact organisations, and is 
likely to make the subject access process more frustrating for members of the 
public. 


Q7 To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly 
disagree Disagree 


Neither agree Strongly 
nor disagree Agree agree 


O O 5 


Pi 


Q8 


Q9 


Please provide any further comments or suggestions you may have about the draft 
guidance. 


There is a conflict between the limited definition of "excessive", clarification requests 
not stopping the timescale, and not able to ask the requester to narrow their scope. 


This will place disproportionate demands on organisations, particularly those with 
various services across different systems. 


Are you answering as: 

O An individual acting in a private capacity (eg someone providing their views as a member of the public) 
C) An individual acting in a professional capacity 

© On behalf of an organisation 

( ) Other 

Please specify the name of your organisation: 

Hampshire County Council 
What sector are you from: 

Local Government 


Q10 How did you find out about this survey? 
©) ICO Twitter account 
(_ ) ICO Facebook account 
(_) ICO LinkedIn account 
C) ICO website 
©) ICO newsletter 
( ) ICO staff member 
(_) Colleague 
(_) Personal/work Twitter account 
(_) Personal/work Facebook account 
(_) Personal/work LinkedIn account 
(_) Other 
If other please specify: 


